A bounds check error in the ReadDataElement function of common.c can cause an attacker to read memory that should not be accessible. This flaw leads to the disclosure of sensitive data without requiring any additional privileges or user interaction, and it manifests as a moderate security weakness identified as CWE‑120. The impact is therefore the leaking of confidential information that may be stored in the device’s memory or accessed by other local applications.

All Android devices that include the vulnerable implementation of common.c are affected. The specific Android OS versions are not listed, but the flaw exists in any build that has the described bounds check error in this file. If a device runs an Android release that has not been patched for this issue, it remains vulnerable.

The CVSS score of 5.5 indicates moderate severity. Because the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the likelihood of widespread exploitation appears limited at present. However, the attack vector is local: any user of the device or a locally installed application can trigger the flaw without user interaction. The consequence is the leakage of private data rather than code execution or denial of service, so the risk is primarily confidentiality. Prompt remediation is recommended to prevent potential misuse.